Technical Information
Malicious functions:
Creates and executes the following:
- "%TEMP%\gasvss.exe" (downloaded from the Internet)
- "%TEMP%\eifhm.exe" (downloaded from the Internet)
- "%TEMP%\uyugnq.exe" (downloaded from the Internet)
- "%TEMP%\xsuty.exe" (downloaded from the Internet)
- "%TEMP%\itvmjwm.exe" (downloaded from the Internet)
- "%TEMP%\qrtdsjxw.exe" (downloaded from the Internet)
- "%TEMP%\750234914" (downloaded from the Internet)
- "%TEMP%\duhnfws.exe" (downloaded from the Internet)
- "%TEMP%\xgxpcp.exe" (downloaded from the Internet)
- "%TEMP%\pflaf.exe" (downloaded from the Internet)
- "%TEMP%\hcwvxw.exe" (downloaded from the Internet)
- "%TEMP%\hwvwybrl.exe" (downloaded from the Internet)
Executes the following:
- <SYSTEM32>\svchost.exe
Modifies file system :
Creates the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\sgnicbidbj[1].php
- %TEMP%\gasvss.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\luckrmksmy[1].php
- %TEMP%\uyugnq.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\yptgomubw[1].php
- %TEMP%\eifhm.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\xofmhs[1].php
- %TEMP%\xsuty.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\cgkfzdywr[1].php
- %TEMP%\qrtdsjxw.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\yckrzu[1].php
- %TEMP%\itvmjwm.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\evdxsql[1].php
- %TEMP%\duhnfws.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\znucw[1].php
- %TEMP%\750234914
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\aeztbmubn[1].php
- %TEMP%\xgxpcp.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\rhlxrztbz[1].php
- %TEMP%\hcwvxw.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\ndhpjrck[1].php
- %TEMP%\pflaf.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\nezgbiub[1].php
- %TEMP%\hwvwybrl.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\xxszuc[1].php
Deletes the following files:
- <SYSTEM32>\svchost.exe
Deletes itself.
Network activity:
Connects to:
- 'ab###ter.com':80
TCP:
HTTP GET requests:
- ab###ter.com/heiqks/luckrmksmy.php?ad################################
- ab###ter.com/heiqks/sgnicbidbj.php?ad################################
- ab###ter.com/heiqks/yptgomubw.php?ad################################
- ab###ter.com/heiqks/cgkfzdywr.php?ad##############################################################
- ab###ter.com/heiqks/xofmhs.php?ad################################
- ab###ter.com/heiqks/yckrzu.php?ad################################
- ab###ter.com/heiqks/evdxsql.php?ad################################
- ab###ter.com/heiqks/znucw.php?ad################################
- ab###ter.com/heiqks/rhlxrztbz.php?ad################################
- ab###ter.com/heiqks/aeztbmubn.php?ad################################
- ab###ter.com/heiqks/ndhpjrck.php?ad################################
- ab###ter.com/heiqks/xxszuc.php?ad################################
- ab###ter.com/heiqks/nezgbiub.php?ad################################
UDP:
- DNS ASK ab###ter.com
